Home / Vulnerability Intelligence / CVE-2026-29872

CVE-2026-29872 - Vulnerability Analysis

HighCVSS: 8.2

Last Updated: March 30, 2026

awesome-llm-apps - Information Disclosure

Published: March 30, 2026Updated: March 30, 2026Remote Exploitable

Overview

awesome-llm-apps contains a cross-session information disclosure caused by storing user API tokens in process-wide environment variables without session isolation, letting attackers access other users' sensitive tokens, exploit requires concurrent multi-user access.

Severity & Score

Severity: High

CVSS Score: 8.2

EPSS Score: 0.0%(Probability of exploitation in next 30 days)

Impact

Attackers can access other users' API tokens, leading to unauthorized access to private resources and potential financial abuse.

Mitigation

Update to a version that implements proper session isolation or the latest available version.

References

https://github.com/lilmingwa13/security-research/blob/main/CVE-2026-29872.md

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Mar 30, 2026

🟠 CVE-2026-29872 - High (8.2) A cross-session information disclosure vulnerability exists in the awesome-llm-apps project in commit e46690f99c3f08be80a9877fab52acacf7ab8251 (2026-01-19). The affected Streamlit-based GitHub MCP Agent stores user-supplied API tokens in process-w... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29872/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Mar 30, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-29872
Severity: High
CVSS Score: 8.2
Type: undefined
Status: new
EPSS: 0.0%
Social Posts: 2

CWE

CWE-200

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

EPSS Score

0.0%Probability of exploitation in the next 30 days